Navigating Privacy in Digital Twin: A Framework for Regulatory Compliance (DTFRC)

Abstract Digital twin (DT) technology has gained significant adoption across domains such as healthcare, manufacturing, and smart cities due to its ability to mirror physical systems and provide real-time intelligence. However, the extensive collection, processing, and sharing of sensitive personal and operational data within DT systems raise substantial challenges related to privacy, security, and regulatory compliance. Although established frameworks—including the General Data Protection Regulation (GDPR), National Institute of Standards and Technology (NIST) guidelines, and International Organization for Standardization (ISO) standards—offer foundational protections, existing research lacks comprehensive compliance models tailored to the multi-layered architecture of DTs. This study examines the evolving regulatory landscape governing DT systems, identifies key compliance challenges, and highlights critical gaps in existing practices. This study conducts a systematic literature review of 31 primary studies, revealing that there are limited DT-specific regulatory frameworks, and only 2 out of 31 studies propose structured compliance frameworks. These findings highlight a significant gap in integrating regulatory requirements across DT functional layers. To address these gaps, we propose a novel Digital Twin Framework for Regulatory Compliance (DTFRC) that specifies and maps GDPR, NIST, and ISO requirements across five DT functional layers. The framework operationalizes legal and industry requirements across the DT technology stack, including IoT, data analytics, Explainable AI (XAI), immersive interfaces, and verification mechanisms. The framework also integrates a multi-level compliance governance structure, Security Education, Training, and Awareness (SETA) strategies to define measurable compliance metrics for continuous monitoring and improvement. The framework emphasizes embedding compliance considerations early in the DT life cycle to enhance transparency, resilience, and trustworthiness in real-world deployments.